Пример #1
0
        private static async Task Run(Service service)
        {
            await service.LogOnAsync(SdkHelper.Splunk.Username, SdkHelper.Splunk.Password);

            string savedSearchName  = "example_search";
            string savedSearchQuery = "search index=_internal | head 10";

            // Delete the saved search if it exists before we start.
            SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync(savedSearchName);

            if (savedSearch != null)
            {
                await savedSearch.RemoveAsync();
            }

            savedSearch = await service.SavedSearches.CreateAsync(savedSearchName, savedSearchQuery);

            Job savedSearchJob = await savedSearch.DispatchAsync();

            using (SearchResultStream stream = await savedSearchJob.GetSearchResultsAsync())
            {
                foreach (SearchResult result in stream)
                {
                    Console.WriteLine(result);
                }
            }

            await savedSearch.RemoveAsync();
        }
Пример #2
0
 /// <summary>
 /// Asynchronously dispatches a <see cref="SavedSearch"/> just like the
 /// scheduler would.
 /// </summary>
 /// <param name="name">
 /// The name of the <see cref="SavedSearch"/> to dispatch.
 /// </param>
 /// <param name="dispatchArgs">
 /// A set of arguments to the dispatcher.
 /// </param>
 /// <param name="templateArgs">
 /// A set of template arguments to the <see cref="SavedSearch"/>.
 /// </param>
 /// <returns>
 /// The search <see cref="Job"/> that was dispatched.
 /// </returns>
 /// <remarks>
 /// This method uses the <a href="http://goo.gl/AfzBJO">POST 
 /// saved/searches/{name}/dispatch</a> endpoint to dispatch the <see 
 /// cref="SavedSearch"/> identified by <see cref="name"/>.
 /// </remarks>
 public async Task<Job> DispatchSavedSearchAsync(string name, SavedSearchDispatchArgs dispatchArgs = null,
     SavedSearchTemplateArgs templateArgs = null)
 {
     var savedSearch = new SavedSearch(this.Context, this.Namespace, name);
     var job = await savedSearch.DispatchAsync(dispatchArgs, templateArgs);
     return job;
 }
        public async Task SavedSearchHistory()
        {
            using (var service = await SdkHelper.CreateService())
            {
                const string name   = "sdk-test_SavedSearchHistory";
                const string search = "search index=sdk-tests * earliest=-1m";

                SavedSearchCollection savedSearches = service.SavedSearches;
                await savedSearches.GetSliceAsync(new SavedSearchCollection.Filter {
                    Count = 0, SortDirection = SortDirection.Descending
                });

                SavedSearch savedSearch = savedSearches.SingleOrDefault(ss => ss.Name == name);

                if (savedSearch != null)
                {
                    await savedSearch.RemoveAsync();
                }

                // Create a saved search
                savedSearch = await savedSearches.CreateAsync(name, search);

                // Clear the history - even though we have a newly create saved search
                // it's possible there was a previous saved search with the same name
                // that had a matching history.

                JobCollection history = await savedSearch.GetHistoryAsync();

                foreach (Job job in history)
                {
                    await job.CancelAsync();
                }

                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(0, history.Count);

                Job job1 = await savedSearch.DispatchAsync();

                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(1, history.Count);
                Assert.True(history.Any(a => a.Sid == job1.Sid)); // this.Contains(history, job1.Sid));

                Job job2 = await savedSearch.DispatchAsync();

                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(2, history.Count);
                Assert.True(history.Any(a => a.Sid == job1.Sid));
                Assert.True(history.Any(a => a.Sid == job2.Sid));

                await job1.CancelAsync();

                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(1, history.Count);
                Assert.True(history.Any(a => a.Sid == job2.Sid));

                await job2.CancelAsync();

                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(0, history.Count);

                //// Delete the saved search
                await savedSearches.GetSliceAsync(new SavedSearchCollection.Filter {
                    Count = 0, SortDirection = SortDirection.Descending
                });

                savedSearch = savedSearches.SingleOrDefault(ss => ss.Name == name);
                Assert.NotNull(savedSearch);

                await savedSearch.RemoveAsync();

                savedSearch = await savedSearches.GetOrNullAsync(savedSearch.Name);

                Assert.Null(savedSearch);
            }
        }
        public async Task SavedSearchDispatchProperties()
        {
            using (var service = await SdkHelper.CreateService())
            {
                // Ensure correct start state

                SavedSearchCollection savedSearches = service.SavedSearches;
                string      name       = "sdk-test_DispatchProperties";
                SavedSearch testSearch = await savedSearches.GetOrNullAsync(name);

                if (testSearch != null)
                {
                    await testSearch.RemoveAsync();
                }

                await savedSearches.GetAllAsync();

                Assert.Null(savedSearches.SingleOrDefault(savedSearch => savedSearch.Name == name));

                // Create a saved search
                testSearch = await savedSearches.CreateAsync(name, "search index=sdk-tests * earliest=-1m");

                // Dispatch the saved search with default arguments
                Job job = await testSearch.DispatchAsync();

                await job.TransitionAsync(DispatchState.Done);

                await job.CancelAsync();

                // Dispatch with some additional search options
                job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs()
                {
                    DispatchBuckets = 100
                });

                await job.TransitionAsync(DispatchState.Done);

                await job.CancelAsync();

                // Dispatch with some additional search options
                job = await testSearch.DispatchAsync(new SavedSearchDispatchArgs()
                {
                    DispatchEarliestTime = "aaaa"
                });

                await job.TransitionAsync(DispatchState.Done);

                await job.CancelAsync();

                var savedSearchTemplateArgs = new SavedSearchTemplateArgs(
                    new Argument("action.email.authpassword ", "sdk-password"),
                    new Argument("action.email.authusername ", "sdk-username"),
                    new Argument("action.email.bcc ", "*****@*****.**"),
                    new Argument("action.email.cc ", "*****@*****.**"),
                    new Argument("action.email.command ", "$name1$"),
                    new Argument("action.email.format ", "text"),
                    new Argument("action.email.from ", "*****@*****.**"),
                    new Argument("action.email.hostname ", "dummy1.host.com"),
                    new Argument("action.email.inline ", "true"),
                    new Argument("action.email.mailserver ", "splunk.com"),
                    new Argument("action.email.maxresults ", "101"),
                    new Argument("action.email.maxtime ", "10s"),
                    new Argument("action.email.pdfview ", "dummy"),
                    new Argument("action.email.reportpaperorientation ", "landscape"),
                    new Argument("action.email.reportpapersize ", "letter"),
                    new Argument("action.email.reportserverenabled ", "false"),
                    new Argument("action.email.reportserverurl ", "splunk.com"),
                    new Argument("action.email.sendpdf ", "false"),
                    new Argument("action.email.sendresults ", "false"),
                    new Argument("action.email.subject ", "sdk-subject"),
                    new Argument("action.email.to ", "*****@*****.**"),
                    new Argument("action.email.trackalert ", "false"),
                    new Argument("action.email.ttl ", "61"),
                    new Argument("action.email.usessl ", "false"),
                    new Argument("action.email.usetls ", "false"),
                    new Argument("action.email.widthsortcolumns ", "false"),
                    new Argument("actions.populatelookup.command ", "$name2$"),
                    new Argument("actions.populatelookup.dest ", "dummypath"),
                    new Argument("actions.populatelookup.hostname ", "dummy2.host.com"),
                    new Argument("actions.populatelookup.maxresults ", "102"),
                    new Argument("actions.populatelookup.maxtime ", "20s"),
                    new Argument("actions.populatelookup.trackalert ", "false"),
                    new Argument("actions.populatelookup.ttl ", "62"),
                    new Argument("actions.rss.command ", "$name3$"),
                    new Argument("actions.rss.hostname ", "dummy3.host.com"),
                    new Argument("actions.rss.maxresults ", "103"),
                    new Argument("actions.rss.maxtime ", "30s"),
                    new Argument("actions.rss.trackalert ", "false"),
                    new Argument("actions.rss.ttl ", "63"),
                    new Argument("actionscriptcommand ", "$name4$"),
                    new Argument("actionscriptfilename ", "action_script_filename"),
                    new Argument("actionscripthostname ", "dummy4.host.com"),
                    new Argument("actionscriptmaxresults ", "104"),
                    new Argument("actionscriptmaxtime ", "40s"),
                    new Argument("actionscripttrackalert ", "false"),
                    new Argument("actionscriptttl ", "64"),
                    new Argument("actions.summaryindex.command ", "$name5$"),
                    new Argument("actions.summaryindex.hostname ", "dummy5.host.com"),
                    new Argument("actions.summaryindex.inline ", "false"),
                    new Argument("actions.summaryindex.maxresults ", "105"),
                    new Argument("actions.summaryindex.maxtime ", "50s"),
                    new Argument("actions.summaryindex.trackalert ", "false"),
                    new Argument("actions.summaryindex.ttl ", "65"),
                    new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));

                //// Same as the previous dispatch except using custom arg
                job = await testSearch.DispatchAsync(templateArgs : savedSearchTemplateArgs);

                await job.TransitionAsync(DispatchState.Done);

                await job.CancelAsync();

                // Delete the saved search
                await testSearch.RemoveAsync();

                testSearch = await savedSearches.GetOrNullAsync(name);

                Assert.Null(testSearch);
            }
        }
        public async Task SavedSearchHistory()
        {
            using (var service = this.Connect())
            {
                string savedSearchTitle = "sdk-test1";

                SavedSearchCollection savedSearches = await service.GetSavedSearchesAsync(
                    new SavedSearchCollectionArgs { Count = 0 });

                // Ensure test starts in a known good state

                if (savedSearches.Any(a => a.Name == savedSearchTitle))
                {
                    await service.RemoveSavedSearchAsync(savedSearchTitle);

                    await savedSearches.GetAsync();
                }

                Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
                string search = "search index=sdk-tests * earliest=-1m";

                // Create a saved search

                SavedSearch savedSearch = await service.CreateSavedSearchAsync(savedSearchTitle,
                                                                               new SavedSearchAttributes()
                {
                    Search = search
                });

                // Clear the history - even though we have a newly create saved search
                // it's possible there was a previous saved search with the same name
                // that had a matching history.

                JobCollection history = await savedSearch.GetHistoryAsync();

                foreach (Job job in history)
                {
                    await job.CancelAsync();
                }

                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(0, history.Count);

                Job job1 = await savedSearch.DispatchAsync();

                this.Ready(job1);
                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(1, history.Count);
                Assert.True(history.Any(a => a.Sid == job1.Sid)); // this.Contains(history, job1.Sid));

                Job job2 = await savedSearch.DispatchAsync();

                this.Ready(job2);
                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(2, history.Count);
                Assert.True(history.Any(a => a.Sid == job1.Sid));
                Assert.True(history.Any(a => a.Sid == job2.Sid));

                await job1.CancelAsync();

                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(1, history.Count);
                Assert.True(history.Any(a => a.Sid == job2.Sid));

                await job2.CancelAsync();

                history = await savedSearch.GetHistoryAsync();

                Assert.Equal(0, history.Count);

                //// Delete the saved search
                await service.RemoveSavedSearchAsync("sdk-test1");

                await savedSearches.GetAsync();

                Assert.False(savedSearches.Any(a => a.Name == "sdk-test1"));
            }
        }
        public void SavedSearchDispatch()
        {
            Service service                     = this.Connect();
            string  savedSearchTitle            = "sdk-test1";
            SavedSearchCollection savedSearches = service.GetSavedSearchesAsync().Result;

            // Ensure test starts in a known good state
            if (savedSearches.Any(a => a.Name == savedSearchTitle))
            {
                service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
                savedSearches.GetAsync().Wait();
            }

            Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));

            // Create a saved search
            string      search      = "search index=sdk-tests * earliest=-1m";
            SavedSearch savedSearch =
                service.CreateSavedSearchAsync(savedSearchTitle, new SavedSearchAttributes()
            {
                Search = search
            }).Result;

            // Dispatch the saved search and wait for results.
            Job job = savedSearch.DispatchAsync().Result;

            job.CancelAsync().Wait();

            // Dispatch with some additional search options
            job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs()
            {
                DispatchBuckets = 100
            }).Result;
            this.Wait(job);
            //job.Timeline().Close();
            job.CancelAsync().Wait();

            // Dispatch with some additional search options
            job = savedSearch.DispatchAsync(new SavedSearchDispatchArgs()
            {
                DispatchEarliestTime = "aaaa"
            }).Result;
            this.Wait(job);
            //job.Timeline().Close();
            job.CancelAsync().Wait();

            SavedSearchTemplateArgs savedSearchTemplateArgs = new SavedSearchTemplateArgs();

            if (this.VersionCompare(service, "6.0") < 0)
            {
                savedSearchTemplateArgs.Add(new Argument("action.email.authpassword ", "sdk-password"));
                savedSearchTemplateArgs.Add(new Argument("action.email.authusername ", "sdk-username"));
                savedSearchTemplateArgs.Add(new Argument("action.email.bcc ", "*****@*****.**"));
                savedSearchTemplateArgs.Add(new Argument("action.email.cc ", "*****@*****.**"));
                savedSearchTemplateArgs.Add(new Argument("action.email.command ", "$name1$"));
                savedSearchTemplateArgs.Add(new Argument("action.email.format ", "text"));
                savedSearchTemplateArgs.Add(new Argument("action.email.from ", "*****@*****.**"));
                savedSearchTemplateArgs.Add(new Argument("action.email.hostname ", "dummy1.host.com"));
                savedSearchTemplateArgs.Add(new Argument("action.email.inline ", "true"));
                savedSearchTemplateArgs.Add(new Argument("action.email.mailserver ", "splunk.com"));
                savedSearchTemplateArgs.Add(new Argument("action.email.maxresults ", "101"));
                savedSearchTemplateArgs.Add(new Argument("action.email.maxtime ", "10s"));
                savedSearchTemplateArgs.Add(new Argument("action.email.pdfview ", "dummy"));
                savedSearchTemplateArgs.Add(new Argument("action.email.reportpaperorientation ", "landscape"));
                savedSearchTemplateArgs.Add(new Argument("action.email.reportpapersize ", "letter"));
                savedSearchTemplateArgs.Add(new Argument("action.email.reportserverenabled ", "false"));
                savedSearchTemplateArgs.Add(new Argument("action.email.reportserverurl ", "splunk.com"));
                savedSearchTemplateArgs.Add(new Argument("action.email.sendpdf ", "false"));
                savedSearchTemplateArgs.Add(new Argument("action.email.sendresults ", "false"));
                savedSearchTemplateArgs.Add(new Argument("action.email.subject ", "sdk-subject"));
                savedSearchTemplateArgs.Add(new Argument("action.email.to ", "*****@*****.**"));
                savedSearchTemplateArgs.Add(new Argument("action.email.trackalert ", "false"));
                savedSearchTemplateArgs.Add(new Argument("action.email.ttl ", "61"));
                savedSearchTemplateArgs.Add(new Argument("action.email.usessl ", "false"));
                savedSearchTemplateArgs.Add(new Argument("action.email.usetls ", "false"));
                savedSearchTemplateArgs.Add(new Argument("action.email.widthsortcolumns ", "false"));
                savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.command ", "$name2$"));
                savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.dest ", "dummypath"));
                savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.hostname ", "dummy2.host.com"));
                savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxresults ", "102"));
                savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.maxtime ", "20s"));
                savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.trackalert ", "false"));
                savedSearchTemplateArgs.Add(new Argument("actions.populatelookup.ttl ", "62"));
                savedSearchTemplateArgs.Add(new Argument("actions.rss.command ", "$name3$"));
                savedSearchTemplateArgs.Add(new Argument("actions.rss.hostname ", "dummy3.host.com"));
                savedSearchTemplateArgs.Add(new Argument("actions.rss.maxresults ", "103"));
                savedSearchTemplateArgs.Add(new Argument("actions.rss.maxtime ", "30s"));
                savedSearchTemplateArgs.Add(new Argument("actions.rss.trackalert ", "false"));
                savedSearchTemplateArgs.Add(new Argument("actions.rss.ttl ", "63"));
                savedSearchTemplateArgs.Add(new Argument("actionscriptcommand ", "$name4$"));
                savedSearchTemplateArgs.Add(new Argument("actionscriptfilename ", "action_script_filename"));
                savedSearchTemplateArgs.Add(new Argument("actionscripthostname ", "dummy4.host.com"));
                savedSearchTemplateArgs.Add(new Argument("actionscriptmaxresults ", "104"));
                savedSearchTemplateArgs.Add(new Argument("actionscriptmaxtime ", "40s"));
                savedSearchTemplateArgs.Add(new Argument("actionscripttrackalert ", "false"));
                savedSearchTemplateArgs.Add(new Argument("actionscriptttl ", "64"));
                savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.command ", "$name5$"));
                savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.hostname ", "dummy5.host.com"));
                savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.inline ", "false"));
                savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxresults ", "105"));
                savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.maxtime ", "50s"));
                savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.trackalert ", "false"));
                savedSearchTemplateArgs.Add(new Argument("actions.summaryindex.ttl ", "65"));
                savedSearchTemplateArgs.Add(new Argument("actions ", "rss,email,populate_lookup,script,summary_index"));
            }

            //// Same as the previous dispatch except using custom arg
            job = savedSearch.DispatchAsync(null, savedSearchTemplateArgs).Result;
            this.Wait(job);
            //job.Timeline().Close();
            job.CancelAsync().Wait();

            // Delete the saved search
            service.RemoveSavedSearchAsync(savedSearchTitle).Wait();
            Assert.False(savedSearches.Any(a => a.Name == savedSearchTitle));
        }